Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-56857

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Description

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library os

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

Go standard library internal/syscall/windows

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

References